Selective disclosure means revealing specific claims from a credential while withholding the rest, without invalidating the issuer signature over what you do reveal. It is how a verifier can learn that someone is over 18 without learning their birth date.
Both mandated formats do it, and both use salted hashes. SD-JWT VC signs digests of salted claim values and ships the disclosures separately. mdoc signs digests of salted data elements inside the Mobile Security Object. The ARF calls the two mechanisms conceptually identical. Either way the verifier confirms each disclosed claim was signed by the issuer and cannot recover the name or value of anything withheld. It can normally still see how many items were withheld, which is why SD-JWT allows decoy digests to blur that count.
Derived claims push it further. A credential can carry age_over_18 as its own attribute, so proving adulthood does not touch the birth date at all. The issuer computed the boolean and signed it.
The wallet consent screen shows the holder exactly which claims a verifier asked for, which puts real commercial pressure on verifiers to ask for less.
Defined in
ARF v3.0.0 sections 5.4.2 and 5.4.3, Annex 2 Topic 6; IETF RFC 9901; ISO/IEC 18013-5
It changes what you have to store, and storing less is most of the win.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
